mini_racer_rs 1.0.0

data/crates/mini_racer_engine/src/serialize.rs

@@ -0,0 +1,253 @@
+use mini_racer_wire::marker;
+
+use crate::snapshot;
+use v8::ValueSerializerHelper;
+
+// mini_racer's filter (mini_racer_v8.cc, MIT, Copyright (c) 2016-2019 the
+// mini_racer project authors), byte for byte. It runs in a context user code
+// never touched, so tampered prototypes cannot change how a value is copied.
+const FILTER_SOURCE: &str = r#"
+;(function($globalThis) {
+    const {Map: $Map, Set: $Set} = $globalThis
+    const sentinel = {}
+    return function filter(v) {
+        if (typeof v === "function")
+            return sentinel
+        if (typeof v !== "object" || v === null)
+            return v
+        if (v instanceof $Map) {
+            const m = new Map()
+            for (let [k, t] of Map.prototype.entries.call(v)) {
+                t = filter(t)
+                if (t !== sentinel)
+                    m.set(k, t)
+            }
+            return m
+        } else if (v instanceof $Set) {
+            const s = new Set()
+            for (let t of Set.prototype.values.call(v)) {
+                t = filter(t)
+                if (t !== sentinel)
+                    s.add(t)
+            }
+            return s
+        } else {
+            const o = Array.isArray(v) ? [] : {}
+            const pds = Object.getOwnPropertyDescriptors(v)
+            for (const [k, d] of Object.entries(pds)) {
+                if (!d.enumerable)
+                    continue
+                let t = d.value
+                if (d.get) {
+                    // *not* d.get.call(...), may have been tampered with
+                    t = Function.prototype.call.call(d.get, v, k)
+                }
+                t = filter(t)
+                if (t !== sentinel)
+                    Object.defineProperty(o, k, {value: t, enumerable: true})
+            }
+            return o
+        }
+    }
+})
+"#;
+
+pub type Tc<'a, 'b, 'c, 'i> = v8::PinnedRef<'a, v8::TryCatch<'b, 'c, v8::HandleScope<'i>>>;
+
+/// The context `mini_racer` copies uncloneable values in, and its filter.
+#[derive(Clone)]
+pub struct Filter {
+    pub context: v8::Global<v8::Context>,
+    function: v8::Global<v8::Function>,
+}
+
+pub fn origin<'s>(
+    scope: &v8::PinScope<'s, '_>,
+    name: v8::Local<'s, v8::Value>,
+) -> v8::ScriptOrigin<'s> {
+    v8::ScriptOrigin::new(scope, name, 0, 0, false, 0, None, false, false, false, None)
+}
+
+/// Creates the safe context, then the user context, as `mini_racer` does. The
+/// filter's setup reads the user context's `Map` and `Set` once, under a
+/// shared security token that is revoked right after.
+///
+/// On an isolate made from a snapshot, the safe context is the blob's
+/// pristine one, so snapshot code cannot reach the filter's built-ins either.
+pub fn contexts(
+    scope: &mut v8::PinScope<'_, '_, ()>,
+    from_snapshot: bool,
+) -> Option<(v8::Global<v8::Context>, Filter)> {
+    let safe = from_snapshot
+        .then(|| {
+            v8::Context::from_snapshot(scope, snapshot::PRISTINE, v8::ContextOptions::default())
+        })
+        .flatten()
+        .unwrap_or_else(|| v8::Context::new(scope, v8::ContextOptions::default()));
+    let user = v8::Context::new(scope, v8::ContextOptions::default());
+    let function = {
+        let scope = &mut v8::ContextScope::new(scope, safe);
+        let source = v8::String::new(scope, FILTER_SOURCE)?;
+        let name = v8::String::new(scope, "safe_context_script.js")?;
+        let origin = origin(scope, name.into());
+        let setup = v8::Script::compile(scope, source, Some(&origin))?.run(scope)?;
+        let setup = v8::Local::<v8::Function>::try_from(setup).ok()?;
+        safe.set_security_token(user.get_security_token(scope));
+        let receiver = v8::undefined(scope).into();
+        let global = user.global(scope).into();
+        let filter = setup.call(scope, receiver, &[global]);
+        safe.use_default_security_token();
+        v8::Local::<v8::Function>::try_from(filter?).ok()?
+    };
+    Some((
+        v8::Global::new(scope, user),
+        Filter {
+            context: v8::Global::new(scope, safe),
+            function: v8::Global::new(scope, function),
+        },
+    ))
+}
+
+/// What `mini_racer` does to a result before serializing it: proxies give way
+/// to their targets, symbols to their descriptions, functions to the marker
+/// its Ruby side reads as `JavaScriptFunction`, and weak collections and
+/// iterators to the entries they would show.
+pub fn sanitize<'s>(
+    scope: &v8::PinScope<'s, '_>,
+    mut value: v8::Local<'s, v8::Value>,
+) -> v8::Local<'s, v8::Value> {
+    while let Ok(proxy) = v8::Local::<v8::Proxy>::try_from(value) {
+        value = proxy.get_target(scope);
+    }
+    if let Ok(symbol) = v8::Local::<v8::Symbol>::try_from(value) {
+        return symbol.description(scope);
+    }
+    if value.is_function() {
+        return v8::String::new_from_two_byte(
+            scope,
+            &marker::JAVASCRIPT_FUNCTION,
+            v8::NewStringType::Normal,
+        )
+        .map_or(value, Into::into);
+    }
+    if (value.is_weak_map()
+        || value.is_weak_set()
+        || value.is_map_iterator()
+        || value.is_set_iterator())
+        && let Ok(object) = v8::Local::<v8::Object>::try_from(value)
+        && let (Some(entries), _) = object.preview_entries(scope)
+    {
+        return entries.into();
+    }
+    value
+}
+
+struct Delegate;
+
+impl Delegate {
+    // V8's message when it has no delegate, which mini_racer's errors carry.
+    fn refuse(scope: &v8::PinScope<'_, '_>, object: v8::Local<'_, v8::Object>) {
+        let message = format!(
+            "#<{}> could not be cloned.",
+            object.get_constructor_name().to_rust_string_lossy(scope)
+        );
+        if let Some(message) = v8::String::new(scope, &message) {
+            let exception = v8::Exception::error(scope, message);
+            scope.throw_exception(exception);
+        }
+    }
+}
+
+impl v8::ValueSerializerImpl for Delegate {
+    fn throw_data_clone_error<'s>(
+        &self,
+        scope: &mut v8::PinScope<'s, '_>,
+        message: v8::Local<'s, v8::String>,
+    ) {
+        let exception = v8::Exception::error(scope, message);
+        scope.throw_exception(exception);
+    }
+
+    // Without an exception V8 would report success having written nothing.
+    fn write_host_object<'s>(
+        &self,
+        scope: &mut v8::PinScope<'s, '_>,
+        object: v8::Local<'s, v8::Object>,
+        _serializer: &dyn ValueSerializerHelper,
+    ) -> Option<bool> {
+        Self::refuse(scope, object);
+        None
+    }
+
+    fn get_wasm_module_transfer_id(
+        &self,
+        scope: &mut v8::PinScope<'_, '_>,
+        module: v8::Local<v8::WasmModuleObject>,
+    ) -> Option<u32> {
+        Self::refuse(scope, module.into());
+        None
+    }
+}
+
+/// Serializes `value` with no filter retry; `None` leaves an exception pending.
+pub fn write(scope: &v8::PinScope<'_, '_>, value: v8::Local<'_, v8::Value>) -> Option<Vec<u8>> {
+    let context = scope.get_current_context();
+    let serializer = v8::ValueSerializer::new(scope, Box::new(Delegate));
+    serializer.write_header();
+    match serializer.write_value(context, value) {
+        Some(true) => Some(serializer.release()),
+        _ => None,
+    }
+}
+
+/// Serializes `value` as `mini_racer` replies. A value V8 refuses goes through
+/// the filter, which runs its getters a second time, and is serialized again.
+/// A failure whose message says the value could not be cloned, from either
+/// step, becomes `mini_racer`'s `{"error": <exception>}`. `None` leaves the
+/// exception in `tc`.
+pub fn reply(
+    tc: &mut Tc<'_, '_, '_, '_>,
+    filter: &Filter,
+    value: v8::Local<'_, v8::Value>,
+) -> Option<Vec<u8>> {
+    // mini_racer serializes in a TryCatch of its own, which is not verbose, and
+    // rethrows from it; V8 never reports a rethrown exception.
+    tc.set_verbose(false);
+    if let Some(bytes) = write(tc, value) {
+        return Some(bytes);
+    }
+    if !tc.can_continue() {
+        return None;
+    }
+    tc.reset();
+    let function = v8::Local::new(tc, &filter.function);
+    let context = v8::Local::new(tc, &filter.context);
+    let filtered = {
+        let scope = &mut v8::ContextScope::new(&mut **tc, context);
+        let receiver = v8::undefined(scope).into();
+        function.call(scope, receiver, &[value])
+    };
+    if let Some(bytes) = filtered.and_then(|filtered| write(tc, filtered)) {
+        return Some(bytes);
+    }
+    if !tc.can_continue() {
+        return None;
+    }
+    // mini_racer tells a clone failure from any other by this text.
+    let message = tc.exception()?.to_string(tc)?;
+    if !message
+        .to_rust_string_lossy(tc)
+        .contains("could not be cloned")
+    {
+        return None;
+    }
+    tc.reset();
+    let error = {
+        let scope = &mut v8::ContextScope::new(&mut **tc, context);
+        let object = v8::Object::new(scope);
+        let key = v8::String::new(scope, "error")?;
+        object.set(scope, key.into(), message.into())?;
+        object
+    };
+    write(tc, error.into())
+}

data/crates/mini_racer_engine/src/snapshot.rs

@@ -0,0 +1,221 @@
+use std::fmt;
+use std::sync::{Arc, Weak};
+
+use crate::control::JsText;
+use crate::serialize::{self, Tc};
+use crate::{EngineError, InvalidSnapshot, runner, sys};
+
+const UNEXPECTED: &str = "unexpected failure";
+
+/// Where every blob keeps a context no script has run in, for the filter's
+/// safe context of a context made from the blob.
+pub const PRISTINE: usize = 0;
+
+// How V8 15.2 lays a blob out (`SnapshotImpl` in v8/src/snapshot/snapshot.cc):
+// little-endian words for its context count, whether it can be rehashed and
+// two checksums, its version string, then the offsets of its sections. The
+// read-only section starts at the first 8-byte boundary after the header, and
+// each section opens with V8's magic number and its payload's length.
+const CONTEXTS: usize = 0;
+const REHASHABLE: usize = 4;
+const VERSION_END: usize = 16 + 64;
+const STARTUP: usize = 80;
+const SHARED_HEAP: usize = 84;
+const FIRST_CONTEXT: usize = 88;
+const WORD: usize = 4;
+const ALIGNMENT: usize = 8;
+const SECTION_HEADER: usize = 8;
+// V8's magic number is 0xC0DE0000 exclusive-ored with a table size under 2^16,
+// so this is its top half.
+const MAGIC_HIGH: usize = 0xC0DE;
+
+/// A startup snapshot's blob, which every context made from it shares.
+///
+/// V8 reads the blob for as long as an isolate made from it lives, whenever it
+/// makes a context from it or checks a code cache against it. Empty, it stands
+/// for no snapshot, as it does in `mini_racer`.
+#[derive(Clone, Default, PartialEq, Eq)]
+pub struct SnapshotBlob(Arc<[u8]>);
+
+impl SnapshotBlob {
+    pub fn new(bytes: &[u8]) -> Result<Self, InvalidSnapshot> {
+        Self::check(bytes)?;
+        Ok(Self(Arc::from(bytes)))
+    }
+
+    /// Refuses a blob V8 would abort on, or read past the end of, before it
+    /// reaches the objects inside: one too short for its header, another V8's,
+    /// or one whose sections do not fit in it, as a truncated one's do not.
+    /// What a section holds is left to V8, so a blob V8 reads despite a damaged
+    /// byte still loads, as it does in `mini_racer`.
+    pub fn check(bytes: &[u8]) -> Result<(), InvalidSnapshot> {
+        if bytes.is_empty() {
+            return Ok(());
+        }
+        // V8 keeps a blob's length in a C int, and aborts unless the blob runs
+        // past the header up to its version.
+        if bytes.len() <= VERSION_END || i32::try_from(bytes.len()).is_err() {
+            return Err(InvalidSnapshot::Corrupt);
+        }
+        let header = bytes.get(..=VERSION_END).map(<[u8]>::to_vec);
+        if !header.is_some_and(|header| v8::StartupData::from(header).is_valid()) {
+            return Err(InvalidSnapshot::Version);
+        }
+        sections_fit(bytes).ok_or(InvalidSnapshot::Corrupt)
+    }
+
+    #[must_use]
+    pub fn as_bytes(&self) -> &[u8] {
+        &self.0
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+
+    #[must_use]
+    pub fn downgrade(&self) -> WeakSnapshotBlob {
+        WeakSnapshotBlob(Arc::downgrade(&self.0))
+    }
+}
+
+/// A `SnapshotBlob` that lives only while a context made from it does.
+#[derive(Debug, Clone)]
+pub struct WeakSnapshotBlob(Weak<[u8]>);
+
+impl WeakSnapshotBlob {
+    #[must_use]
+    pub fn upgrade(&self) -> Option<SnapshotBlob> {
+        self.0.upgrade().map(SnapshotBlob)
+    }
+}
+
+impl fmt::Debug for SnapshotBlob {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        f.debug_struct("SnapshotBlob")
+            .field("len", &self.0.len())
+            .finish()
+    }
+}
+
+fn word(bytes: &[u8], at: usize) -> Option<usize> {
+    let word = bytes.get(at..at.checked_add(WORD)?)?;
+    usize::try_from(u32::from_le_bytes(word.try_into().ok()?)).ok()
+}
+
+// What V8 checks as it finds each section, the rehashability flag included,
+// and the payload length it then trusts without a check.
+fn sections_fit(bytes: &[u8]) -> Option<()> {
+    let contexts = word(bytes, CONTEXTS).filter(|contexts| *contexts > 0)?;
+    word(bytes, REHASHABLE).filter(|flag| *flag <= 1)?;
+    let header = contexts.checked_mul(WORD)?.checked_add(FIRST_CONTEXT)?;
+    let mut start = header.checked_next_multiple_of(ALIGNMENT)?;
+    let magic = word(bytes, start).filter(|magic| magic >> 16 == MAGIC_HIGH)?;
+    let ends = [STARTUP, SHARED_HEAP]
+        .into_iter()
+        .chain((0..contexts).map(|index| FIRST_CONTEXT + index * WORD))
+        .map(|at| word(bytes, at))
+        .chain([Some(bytes.len())]);
+    for end in ends {
+        let end = end?;
+        let section = bytes.get(start..end)?;
+        let payload = word(section, WORD)?;
+        if word(section, 0)? != magic || payload > section.len().checked_sub(SECTION_HEADER)? {
+            return None;
+        }
+        start = end;
+    }
+    Some(())
+}
+
+// mini_racer reads the code back from V8 as UTF-8, which turns a lone
+// surrogate into U+FFFD; V8 decodes UTF-8 and Latin-1 as mini_racer's does.
+fn source<'s>(tc: &Tc<'s, '_, '_, '_>, code: &JsText) -> Option<v8::Local<'s, v8::String>> {
+    match code {
+        JsText::Utf16(units) => {
+            let mut fixed = Vec::with_capacity(units.len());
+            for decoded in char::decode_utf16(units.iter().copied()) {
+                let mut buffer = [0; 2];
+                let unit = decoded.unwrap_or(char::REPLACEMENT_CHARACTER);
+                fixed.extend_from_slice(unit.encode_utf16(&mut buffer));
+            }
+            runner::string(tc, &JsText::Utf16(fixed))
+        }
+        JsText::Utf8(_) | JsText::Latin1(_) => runner::string(tc, code),
+    }
+}
+
+/// Builds a startup snapshot in an isolate of its own, as `mini_racer` does:
+/// from `code` run in a fresh context, or, with `base`, by running `code` in
+/// a context of that snapshot that is then discarded, keeping the code V8
+/// compiled meanwhile.
+/// `building` sees the isolate first, so a pending fork can interrupt it.
+pub fn create(
+    code: &JsText,
+    base: Option<&SnapshotBlob>,
+    building: impl FnOnce(&mut v8::Isolate),
+) -> Result<Vec<u8>, EngineError> {
+    let warmup = base.is_some();
+    // `base` outlives the isolate, which `create_blob` disposes of.
+    let mut isolate = base.map_or_else(
+        || v8::Isolate::snapshot_creator(None, None),
+        |blob| {
+            v8::Isolate::snapshot_creator_from_existing_snapshot(
+                sys::startup_data(blob),
+                None,
+                None,
+            )
+        },
+    );
+    building(&mut isolate);
+    let (name, handling) = if warmup {
+        ("<warmup>", v8::FunctionCodeHandling::Keep)
+    } else {
+        ("<snapshot>", v8::FunctionCodeHandling::Clear)
+    };
+    let outcome = {
+        v8::scope!(let scope, &mut isolate);
+        // A new context of a warmup's base blob would carry the snapshot's
+        // script, so the base blob's own pristine context is kept.
+        let pristine = warmup
+            .then(|| v8::Context::from_snapshot(scope, PRISTINE, v8::ContextOptions::default()))
+            .flatten()
+            .unwrap_or_else(|| v8::Context::new(scope, v8::ContextOptions::default()));
+        scope.add_context(pristine);
+        let context = v8::Context::new(scope, v8::ContextOptions::default());
+        let outcome = {
+            let scope = &mut v8::ContextScope::new(scope, context);
+            v8::tc_scope!(let tc, scope);
+            run(tc, code, name)
+        };
+        // V8 needs a default context to write a blob even on the error path;
+        // a fresh one leaves the failed script's objects unreachable, so
+        // writing it cannot meet one V8 refuses to serialize.
+        let default = if warmup || outcome.is_err() {
+            v8::Context::new(scope, v8::ContextOptions::default())
+        } else {
+            context
+        };
+        scope.set_default_context(default);
+        outcome
+    };
+    let blob = isolate.create_blob(handling);
+    outcome?;
+    blob.map(|blob| blob.to_vec())
+        .ok_or_else(|| EngineError::Snapshot(UNEXPECTED.to_owned()))
+}
+
+fn run(tc: &Tc<'_, '_, '_, '_>, code: &JsText, name: &str) -> Result<(), EngineError> {
+    let source = source(tc, code).ok_or_else(|| failure(tc))?;
+    let name = v8::String::new(tc, name).ok_or_else(|| failure(tc))?;
+    let origin = serialize::origin(tc, name.into());
+    let script = v8::Script::compile(tc, source, Some(&origin)).ok_or_else(|| failure(tc))?;
+    script.run(tc).ok_or_else(|| failure(tc))?;
+    Ok(())
+}
+
+// mini_racer's format: the message, then where it happened.
+fn failure(tc: &Tc<'_, '_, '_, '_>) -> EngineError {
+    EngineError::Snapshot(runner::located(tc, "\n").unwrap_or_else(|| UNEXPECTED.to_owned()))
+}

data/crates/mini_racer_engine/src/spin.rs

@@ -0,0 +1,23 @@
+use std::time::{Duration, Instant};
+
+/// Spins until `ready` or the budget runs out; returns whether it became ready.
+pub fn spin_until(budget: Duration, mut ready: impl FnMut() -> bool) -> bool {
+    if ready() {
+        return true;
+    }
+    if budget.is_zero() {
+        return false;
+    }
+    let start = Instant::now();
+    loop {
+        for _ in 0..32 {
+            std::hint::spin_loop();
+            if ready() {
+                return true;
+            }
+        }
+        if start.elapsed() >= budget {
+            return ready();
+        }
+    }
+}